What is the CVSS score of CVE-2026-34045?

CVE-2026-34045 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kubernetes are affected by CVE-2026-34045?

Podman Desktop versions prior to 1.26.2 contain an unauthenticated network vulnerability that allows remote attackers to crash the application or freeze the host system through denial-of-service…. A patch is available.

How to fix or mitigate CVE-2026-34045?

Within 24 hours: Identify all systems running Podman Desktop and document current versions. Within 7 days: Apply vendor patch to upgrade all affected instances to Podman Desktop version 1.26.2 or later, and verify successful deployment across all endpoints. Within 30 days: Conduct post-patch validation testing, review access logs for suspicious network activity targeting the HTTP server port, and implement network segmentation to restrict HTTP server access to trusted networks only.

Kubernetes CVE-2026-34045

EUVD-2026-19943 HIGH

Error Message Information Leak (CWE-209)

2026-04-07 security-advisories@github.com

Information Disclosure Kubernetes Microsoft Red Hat

8.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.26.2

Re-analysis Queued

Apr 15, 2026 - 23:37 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 21:22 euvd

EUVD-2026-19943

Analysis Generated

Apr 07, 2026 - 21:22 vuln.today

CVE Published

Apr 07, 2026 - 21:17 nvd

HIGH 8.2

DescriptionNVD

Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive information. By abusing missing connection limits and timeouts, an attacker can exhaust file descriptors and kernel memory, leading to application crash or full host freeze. Additionally, verbose error responses disclose internal paths and system details (including usernames on Windows), aiding further exploitation. The issue requires no authentication or user interaction and is exploitable over the network. This vulnerability is fixed in 1.26.2.

AnalysisAI

Unauthenticated network access to Podman Desktop's HTTP server enables remote denial-of-service attacks and information disclosure via verbose error messages. Attackers can exhaust file descriptors and kernel memory without authentication, causing application crashes or complete host freezes, while error responses leak internal paths and Windows usernames. …

RemediationAI

Within 24 hours: Identify all systems running Podman Desktop and document current versions. Within 7 days: Apply vendor patch to upgrade all affected instances to Podman Desktop version 1.26.2 or later, and verify successful deployment across all endpoints. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-10044 HIGH This Week POC

8.2 May 28

{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat

CVE-2026-40412 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil

CVE-2026-41104 CRITICAL Monitor

10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal

CVE-2026-23652 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-

CVE-2026-47280 CRITICAL Monitor

10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti

Vendor StatusVendor

CVE-2026-34045 vulnerability details – vuln.today

Back

Kubernetes CVE-2026-34045

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Vendor StatusVendor

Share

External POC / Exploit Code